@@ -137,6 +137,12 @@ a version without a non-empty section in this file.
     `apply --check`, hosted mode and `vex` read the module graph to tell
     whether the patch is really built, instead of reporting it applied
     while `go build` linked the unpatched code (#1840, #1843).
+  - In a go 1.16-or-older module where a downgrade left the old version's
+    `go.sum` lines behind, `apply`, `apply --check`, hosted mode and `vex`
+    use the version the module graph selects instead of the highest
+    `go.sum` line. When the module cache can't answer, they fail closed:
+    `apply` refuses with a remedy, `apply --check` reports drift, and the
+    patch is not pinned or attested (#1862, #1893).
   - `vex` reads the `go.work` that governs the project (`GOWORK`, else the
     nearest one at or above it, with members anywhere), as hosted and
     vendored modes already did, and no longer attests a Socket replace the
@@ -240,7 +246,8 @@ a version without a non-empty section in this file.
   Test fixes: PDM e2e compat pins bounded by release, a Windows-only
   scala-cli liveness test, NuGet walk tests isolated from the host cache
   (#2034, #2035, #2037); CI retries `setup-ruby` and `setup-deno` once
-  on a release-CDN error (#2041, #2042).
+  on a release-CDN error (#2041, #2042), `lint-ecosystems` installs retry
+  release 504s, and `vexctl` is cached on every OS (#2040, #2039).
 
 ## [5.0.1] — 2026-10-13